India’s DPDP Act, 2023 creates a dedicated privacy enforcement framework, but leaves important questions on compensation, mediation, civil court remedies and the independence of the Data Protection Board. This TLC Insight analyses the remedy gap and the next phase of data protection litigation in India.

The Digital Personal Data Protection Act, 2023 ("DPDP Act"), operationalised through the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") notified on November 13, 2025, represents a fundamental transformation in India's approach to data governance. This legislative framework establishes binding obligations on how organisations collect, process, store and share personal data, while simultaneously empowering individuals with unprecedented control over their digital i